suricata

Commit Graph

Author	SHA1	Message	Date
Pascal Delalande	80f2fbac6e	rust/tftp: eve logging with rust	7 years ago
Pascal Delalande	0ff60f65ec	doc: update filestore for file hash extraction Update for extraction based on md5, sha1 and sha256	7 years ago
Victor Julien	07738af868	detect/content: introduce startswith modifier Add startswith modifier to simplify matching patterns at the start of a buffer. Instead of: content:"abc"; depth:3; This enables: content:"abc"; startswith; Especially with longer patterns this makes the intention of the rule more clear and eases writing the rules. Internally it's simply a shorthand for 'depth:<pattern len>;'. Ticket https://redmine.openinfosecfoundation.org/issues/742	7 years ago
Jason Ish	5420c0ab06	doc: document file-store v2	7 years ago
Victor Julien	746638b220	cuda: remove Remove CUDA support as it has been broken for a long time. Ticket #2382.	7 years ago
Eric Leblond	24f745553c	doc: update file extraction document Define the list of protocol parsers supporting extraction in one single place following Andreas Herz' suggestion.	7 years ago
Eric Leblond	f5ba4c231d	doc: update following ftp-data changes	7 years ago
Giuseppe Longo	70695201f6	doc: add memcap commands in unix-socket section	7 years ago
Eric Leblond	3bf098e52f	doc: document log reopen unix socket command	7 years ago
Victor Julien	be9ec3958e	doc: initial suricata-update page	7 years ago
Andreas Herz	6f0794c16f	keyword-filesize: add units	7 years ago
Dana Helwig	3ab9120821	source-pcap-file: Pcap Directory Mode (Feature #2222 ) https://redmine.openinfosecfoundation.org/issues/2222 Pcap file mode that when passed a directory will process all files in that directory. If --pcap-file-continuous or continuous option is passed in json, the directory will be monitored until the directory is moved/deleted, suricata is interrupted, or the pcap-interrupt command is used with unix command socket. Existing file implementation and new directory implementation has moved from source-pcap-file into pcap-file-helper and pcap-directory-helper. Engine state will not reset between files. Also satisfies: * https://redmine.openinfosecfoundation.org/issues/2299 * https://redmine.openinfosecfoundation.org/issues/724 * https://redmine.openinfosecfoundation.org/issues/1476 Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and Danny Browning <danny.browning@protectwise.com>	7 years ago
Eric Leblond	94e9d13791	doc: add ruleset commands available in unix socket	7 years ago
Pascal Delalande	0c99338e07	doc: update docs for DNS flags logging	7 years ago
Ralph Broenink	f6938933d9	doc: Amend the list of accepted protocols Based on the list in suricata.yaml	7 years ago
Ralph Broenink	d830177b7b	doc: Add my own name to the acknowledgements	7 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	7 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	7 years ago
Ralph Broenink	196ba1da70	doc: Make the header keywords section separate sections in ToC	7 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	7 years ago
Ralph Broenink	f6c766112c	doc: Minor changes in structuring of HTTP Keywords / Snort differences	7 years ago
Ralph Broenink	e9b25988ba	doc: Move pcre entirely to Payload Keywords section (plus remove lingering screenshot of a rule)	7 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	7 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	7 years ago
Ralph Broenink	11990c7117	doc: Move the definition of modifier keywords to the introduction	7 years ago
Ralph Broenink	dfae19247d	doc: Completely rewrite the rules introduction for more clearity	7 years ago
Ralph Broenink	274c36eb2f	doc: Meta-settings -> Meta Keywords plus some textual changes Most importantly, conventions are now placed in tip boxes	7 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	7 years ago
Ralph Broenink	a52aacb4ea	doc: Replace images of tables and rules with text in rules docs In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis. Additionally, some tables embedded into images were also replaced by reST tables.	7 years ago
Ralph Broenink	44926e2369	doc: Add suricata.css to allow for some custom styling	7 years ago
Ruslan Usmanov	1090ee9d8d	rate_filter by_both through IPPair storage Ticket https://redmine.openinfosecfoundation.org/issues/2127	7 years ago
Gaurav Singh	637a7c8e55	Adds options to mark when a file is final. This takes the form of an option to add the pid of the process to file names. Additionally, it adds a suffix to the file name to indicate it is not finalized. Adding the pid to the file name reduces the likelihood that a file is overwritten when suricata is unexpectedly killed. The number in the waldo file is only written out during a clean shutdown. In the event of an improper shutdown, extracted files will be written using the old number and existing files with the same name will be overwritten. Writes extracted files and their metadata to a temporary file suffixed with '.tmp'. Renames the files when they are completely done being written. As-is there is no way to know that a file on disk is still being written to by suricata.	7 years ago
Mats Klepsland	9556d4fef3	doc: add documentation for tls_cert_fingerprint keyword	7 years ago
Victor Julien	1180687574	doc/file_data: add note on negated matching Explain issue #2216 and how to avoid it.	8 years ago
Victor Julien	456af8faa8	doc/napatech: formatting fixes	8 years ago
Andreas Herz	c048ee6505	doc: reflect most recent cpu affinity settings Some settings like output-cpu-set never been used and detect got renamed to worker. This reflects those changes already present in the yaml also within the documentation.	8 years ago
Julian	f27b4fc8fe	redis: support for rpush in list mode This adds a new redis mode rpush. Also more consistent config keywords orientated at the redis command: lpush and publish. Keeping list and channel config keywords for backwards compatibility	8 years ago
Phil Young	5f613e6e7d	napatech: Added section describing packet counters.	8 years ago
Phil Young	f6838f9085	napatech: Added description of hba usage.	8 years ago
Victor Julien	fc229430f8	doc: add rust and update version in install	8 years ago
Sebastian Garcia	d32ba60b51	Update public-data-sets.rst with stratosphere project Add the datasets of the Stratosphere project to the list.	8 years ago
Jason Ish	f715b0ae6b	doc: add pid-file section to suricata.yaml doc Redmine issue: https://redmine.openinfosecfoundation.org/issues/2104	8 years ago
Jason Ish	59d69666ea	doc: add more details to log rotation doc	8 years ago
Jason Ish	92f15b7ffb	doc: move log rotation to output section	8 years ago
Victor Julien	62b6f9fe25	decode: add config option to disable teredo Ticket #744.	8 years ago
Abbed	320b032a88	doc: small typo under '4.3.1.5' section	8 years ago
Eric Leblond	b763c7ec11	doc: document http-body logging	8 years ago
Eric Leblond	9e581436a7	doc: info about new config for alert events in EVE	8 years ago
Eric Leblond	ef88689f1e	doc: add app_proto to alert event	8 years ago
Selivanov Pavel	5162b58260	Fixed small typo: double sudo	8 years ago

1 2 3 4

166 Commits (6f339abdf01f972d213d1c9e76ff3d427e1eb183)